I would like to know practical difference between TAP and TUN mode when use with OpenVPN.

When to use TAP and When to use TUN ?

What types of traffic will pass with both mode ?

1 Answer 1


TAP is basically at Ethernet level (layer 2) and acts like a switch where as TUN works at network level (layer 3) and routes packets on the VPN. TAP is bridging whereas TUN is routing.

From the OpenVPN Wiki:

TAP benefits:

  • behaves like a real network adapter (except it is a virtual network adapter)
  • can transport any network protocols (IPv4, IPv6, Netalk, IPX, etc, etc)
  • Works in layer 2, meaning Ethernet frames are passed over the VPN tunnel
  • Can be used in bridges

TAP drawbacks:

  • causes much more broadcast overhead on the VPN tunnel
  • adds the overhead of Ethernet headers on all packets transported over the VPN tunnel
  • scales poorly

TUN benefits:

  • A lower traffic overhead, transports only traffic which is destined for the VPN client
  • Transports only layer 3 IP packets

TUN drawbacks:

  • Broadcast traffic is not normally transported
  • Can only transport IPv4 (OpenVPN 2.3 adds IPv6)
  • Cannot be used in bridges

Not the answer you're looking for? Browse other questions tagged .